Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24254

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown College publisher Import

  • 0.1 to ≤ 0.1affected

References